Struct PolicyRule 

pub struct PolicyRule {
    pub peer_id: String,
    pub action: Action,
    pub resource: Resource,
    pub expires_at: Option<u64>,
    pub attributes: BTreeMap<String, String>,
    pub context_expr: Option<ContextExpr>,
}

A single policy rule with optional ABAC (Attribute-Based Access Control) features

Fields

peer_id: String

Peer ID that this rule applies to

action: Action

Action allowed by this rule

resource: Resource

Resource this rule applies to

expires_at: Option<u64>

Optional expiration timestamp (Unix seconds) If set, the rule is only valid before this time

attributes: BTreeMap<String, String>

Optional context attributes for conditional access (legacy - simple key-value matching) Examples: {“location”: “office”, “security_level”: “high”}

Uses BTreeMap for deterministic serialization (cryptographic safety)

Note: This is the legacy ABAC mechanism. For complex boolean logic, use context_expr instead.

context_expr: Option<ContextExpr>

Optional context expression for advanced ABAC (boolean logic)

This provides more powerful conditional logic than simple attribute matching:

• Boolean operators: AND, OR, NOT
• Comparison operators: ==, !=, <, <=, >, >=
• Attribute existence checks: HAS

Examples:

• role == "admin" AND department == "IT"
• (role == "admin" OR role == "moderator") AND active == "true"
• NOT (status == "banned")

When both attributes and context_expr are present, both must match.

Implementations

impl PolicyRule

pub fn new(peer_id: String, action: Action, resource: Resource) -> Self

Create a new policy rule with basic RBAC

pub fn with_expiration( peer_id: String, action: Action, resource: Resource, expires_at: u64, ) -> Self

Create a new policy rule with expiration (ABAC)

pub const fn with_attributes( peer_id: String, action: Action, resource: Resource, attributes: BTreeMap<String, String>, ) -> Self

Create a new policy rule with attributes (ABAC)

pub const fn expires_at(self, timestamp: u64) -> Self

Add an expiration time to this rule

pub fn with_attribute( self, key: impl Into<String>, value: impl Into<String>, ) -> Self

Add an attribute to this rule

pub fn with_context_expr(self, expr: ContextExpr) -> Self

Add a context expression to this rule (advanced ABAC)

Example

use core_policy::{PolicyRule, Action, Resource, ContextExpr};

let rule = PolicyRule::new("alice".into(), Action::Read, Resource::All)
    .with_context_expr(ContextExpr::parse("role == \"admin\"").unwrap());

pub fn is_expired(&self, current_time: u64) -> bool

Check if this rule has expired

pub fn matches_context(&self, context: &BTreeMap<String, String>) -> bool

Check if this rule’s attributes match the given context

This method evaluates both legacy attribute matching and the new context expression:

1. If attributes is non-empty, all attributes must match (legacy behavior)
2. If context_expr is present, it must evaluate to true
3. Both conditions must be satisfied if both are present

Returns true if all context constraints match.

pub fn allows( &self, peer_id: &str, action: &Action, resource: &Resource, ) -> bool

Check if this rule allows a specific action on a resource for a peer Basic RBAC check (no time or context validation)

pub fn allows_with_context( &self, peer_id: &str, action: &Action, resource: &Resource, current_time: u64, context: &BTreeMap<String, String>, ) -> bool

Check if this rule allows a specific action on a resource for a peer Includes time-based and attribute-based checks

Trait Implementations

impl Clone for PolicyRule

fn clone(&self) -> PolicyRule

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for PolicyRule

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for PolicyRule

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for PolicyRule

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.